Live › vulnerability › CVE-2026-116575
Go to dashboardMem0's Python and TypeScript SDKs build a session key by joining user_id, agent_id and run_id with unescaped delimiters, so distinct tenants can collide on the same key. An attacker who controls an identifier can read or disrupt another tenant's recent raw messages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Applications that let end users or other tenants influence the user_id, agent_id or run_id values sent to Mem0 are exposed, because a crafted identifier can map onto another tenant's session key. Single-tenant deployments where these values are fully server-chosen are much less exposed. The sources do not say whether the hosted Mem0 platform is affected.
No product ranges from the sources yet.
pip show mem0ai and the TypeScript SDK with npm ls mem0aiuser_id, agent_id or run_id on Memory.add(), AsyncMemory.add() or POST /memories2.0.18 or later3.1.6 or later& or =Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-116575")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.